LearnPress < 4.1.3.1 – Multiple Admin+ Stored Cross-Site Scripting | CVE 2021-24702 | Plugin Vulnerabilities

Description

The plugin does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed

Proof of Concept

When adding new courses, the following fields can have XSS payloads like "><script>alert(1)</script> injected into them: 
- Course Settings > General > External Link field 
- Course Settings > Extra Information > Requirements field
- Course Settings > Extra Information > Target Audience field
- Course Settings > Extra Information > Key Features field
- Course Settings > Extra Information > FAQ Title field

Affects Plugins

Fixed in 4.1.3.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Shivam Rai

Submitter

Shivam Rai

Submitter twitter

Verified

Yes

WPVDB ID

30635cc9-4415-48bb-9c67-ea670ea1b942

Timeline

Publicly Published

2021-09-20 (about 4 years ago)

Added

2021-09-20 (about 4 years ago)

Last Updated

2022-04-10 (about 3 years ago)

Other

Published

Title

Published

2023-10-31

Title

Login Screen Manager <= 3.5.2 - Stored XSS via CSRF

Published

2024-10-31

Title

(dp) AddThis <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-01-16

Title

WordPress-to-candidate for Salesforce CRM <= 1.0.1 - Reflected Cross-Site Scripting

Published

2024-05-03

Title

ElementsReady Addons for Elementor < 5.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-06-16

Title

Request a Quote < 2.3.4 - Authenticated Stored XSS